Vulnerability Management Isn't Simple ... (or, How to Make Your VM Progr...